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SUMMARY 

This report identifies the unique aspects of the Centaur Dl-A systems and 
subsystems. Centaur performance is described in terms of optimality (pro- 
pellant usage), flexibility, and airborne computer requirements. Major 
systems are described narratively with some numerical data given where it may 
be useful. 
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INTRODUCTION 

The Centaur Dl-A launch vehicle continues to be a key element In the 
Nation's space program. The Atlas/Centaur and Titan/Centaur combinations have 
boosted into orbit a variety of spacecraft on scientific, lunar, and planetary 
exploration missions and Earth orbit missions. These versatile, reliable, and 
accurate space booster systems will contribute to many significant space pro- 
grams well into the shuttle era. 

Centaur Dl-A is the latest version of the Nation's first high-energy 
cryogenic launch vehicle. Major Improvements in avionics and payload struc- 
ture have enhanced mission flexibility and mission success reliability. The 
liquid hydrogen and liquid oxygen propellants and the pressurized stainless 
steel structure provide a top-performance vehicle. 

Centaur's primary thrust comes from two Pratt & Whitney constant- 
thrust, turbopump-fed, regenerati vely cooled, liquid-fueled rocket engines. 
Each RL10A-3-3a engine can generate 16 500 lb of thrust, for a total thrust of 
33 000 lb. The engines use liquid hydrogen and liquid oxygen as propellants 
and can make multiple starts after a long period in space. The initial flow 
of propellants (gaseous) is ignited with a spark Ignitor, an Integral part of 
the engine. The engine system and its components are purged with gaseous 
helium before lift-off to preclude moisture contamination. 

The Hamilton-Standard reaction control engines (a total of 12 for both 
engines) provide 6 lb of thrust each. Thrust is generated by catalytical ly 
decomposing (in the catalyst, which is an Internal unit of the engine) the 
monopropellant hydrazine (N 2 H 4 ). 

Centaur Dl-A is the designation for the model that flies with the Atlas-G 
first stage. Since the Centaur Dl-A became operational in 1973 (with AC-30) 
it has launched Intelsats, Pioneers, Mariner-Venus , Fleetsatcoms , Comstars, 
HEAO's, etc. Centaur as the upper stage vehicle for the Titan 1 1 1 E booster is 
designated as Centaur Dl-T . This combination was the launch vehicle for the 
Voyager, Viking, and Hellos missions. 

The Atlas-G has Incorporated the latest Improvements in propulsion, tank 
length, and various subsystems. The Atlas lineage traces back to the Atlas 


weapon system. These improvements and modifications have updated Atlas to one 
of today's advanced boosters for Centaur. 

Immediate predecessors to Atias-G/Centaur Dl-A were the Atlas 
SLV-3D/Centaur Dl-A and the Atlas SLV-3C/Centaur D. Their achievements 
Include the launches of Surveyor, the Applications Technology Satellite, 
Orbiting Astronomical Observatories, Mariner Mars '69 and '71, Intelsats, and 
Pioneer F. 


Avionics 

The Centaur Dl-A avionic system Integrates many former hardware functions 
into the airborne computer software: digital autopilot, maneuvering attitude 

control, sequencing, telemetry formatting, propellant management, and guidance 
and navigation. This results in a flexible system that is readily adaptable 
to mission or vehicle changes. Most of the avionics are located on the 
forward equipment module. 

The primary objective of the Centaur Dl-A avionics is to place the space- 
craft into its prescribed coordinates while maintaining high reliability in 
all affected subsystems. The flight-proven hardware from which it is derived 
has a high level of maturity. The use of existing hardware and procedures 
reduces the number of critical paths in the development schedule for new 
missions and minimizes the unknowns associated with integrating a flight- 
booster stage or payload into the Centaur Dl-A systems. 


System Effectiveness 

The Centaur Dl-A system effectiveness objective is total mission 
success - specifically the elimination of launch scrubs, mission failures, or 
mission degradation - at the lowest cost. To meet this objective, NASA Lewis 
management techniques and systems have been adapted to the specific Centaur 
mission requirements. These techniques concentrate on preserving system 
safety and high performance margins, as well as the reliability inherent in 
the Centaur design and associated equipment. 


Reliability 

The Centaur is uniquely qualified (i.e., it exists, it has been quali- 
fied, and it has been space proven many times) and is Inherently a reliable 
high-energy upper stage vehicle. Its extremely high Inherent design reli- 
ability is the result of the following: 

(1) The basic avionic units are built from the highest quality electrical 
and electronic parts available and under the supervision of NASA Lewis engi- 
neering control. 

(2) Rigorous failure modes and effects analyses were performed as an 
Integral part of the design process. The basic thrust of this process was to 
identify failures and to ensure that their probability of occurrence or effect 
is minimized. 
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(3) A rigorous and demanding qualification program (component and vehicle 
level) involving extensive testing has been completed by NASA Lewis. 

Any qualification failures were the impetus for hardware and system 
redesign. High inherent reliability has been, and will continue to be, 
assured by a detailed and comprehensive failure-tracking system. This system 
requires that all major and critical failures be reviewed for adequacy of cor- 
rective action by both NASA Lewis and the contractor's failure review board. 


CENTAUR AVIONICS 

The avionics Include the electronic and electrical hardware used to per- 
form all computation, signal conditioning, data processing, and software for- 
matting associated with navigation, guidance, control, data management, and 
propellant management. The avionics also provide the communications between 
Centaur and the ground stations and control the electric power distribution. 
Centaur avionics consist of the following subsystems: 

(1) Guidance and navigation 

(2) Data management 

(3) Thrust vector control 

(4) Telemetry and instrumentation 

(5) C-band tracking 

(6) Range safety command 

(7) Electric power 

(8) Vehicle sequencing control 

(9) Propellant/pressurization management and control 

(10) Digital computer unit software 


Guidance and Navigation Subsystem 

Centaur uses an Earth-centered inertial guidance and navigation system to 
furnish measurements of angular rates, linear accelerations, and other sensor 
data to the data management subsystem for appropriate processing by the soft- 
ware resident in the digital computer unit (DCU). The Honeywell guidance and 
navigation subsystem (called the inertial measurement group, IMG) consists of 
an Inertial reference unit (IRU), which contains a four-gimbal, gyrostabi 1 1 zed 
platform that supports the orthogonal accelerometers, and an electronics 
unit. The electronics provide conditioned power, glmbal stabilization, gyro- 
torquing, synchronization, and the necessary computer Interfaces for the iner- 
tial sensors. The IMG also measures acceleration and provides a time refer- 
ence to the DCU for navigation computations. 

The navigation function is to measure sensed acceleration, compute grav- 
ity contributions to vehicle acceleration, determine time, and integrate the 
net vehicle accelerations in order to maintain continuous values of position 
and velocity. The referenced Inertial coordinate system is maintained in the 
IRU by gyros mounted on a platform. The platform, the inner glmbal of a four- 
gimbal assembly, Is kept fixed in space by the movement of the outer gimbals 
with respect to it, each other, and the vehicle. The platform Itself has 
unlimited three-degrees-of-f reedom movement. If the platform rotates from the 
inertial reference, the gyros sense this and put out an error signal. The 
error signal is then used to drive the platform back to its proper 
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orientation. In responses to disturbances the platform Is stabilized by three 
orthogonally mounted one-degree-of-f reedom gyros that drive the appropriate 
glmbal through resolvers and torque motors. No resolving of the W (Inner) 
gyro output Is required since the W axis Is fixed In space by the Inner 
middle and outer middle gimbals. 

The IMG Is calibrated and aligned both In the factory and on the launch 
pad. The navigation function Is Initialized at lift-off and Integrated In the 
navigation software to determine the current state vector. 

Centaur uses an explicit guidance algorithm to generate thrust steering 
commands, engine Ignition and shutdown times, and reaction control system 
(RCS) vernier thrust cutoff times. Before each engine Ignition and each RCS 
vernier thrust cutoff, the vehicle Is oriented to a thrust attitude based on 
nominal performance. During each engine burn the commanded attitude is 
adjusted to compensate for buildup of position and velocity errors due to off- 
nominal engine performance (e.g., thrust specific impulse) and uncompensated 
gyro drifts. This adjustment Is based on the current state vector as deter- 
mined from the navigation function and the desired final drift. Residual 
errors 3a resulting from engine burns and shutdowns are compensated for by 
calculated variations in the Injection module heading and the firing time. 

Attitude control In response to guidance commands is provided by thrust 
vector control (TVC) during powered flight and by RCS's during coast. The 
measured attitude from the guidance and navigation subsystem is compared with 
the guidance commands to generate error signals. During engine burn these 
error signals drive the engine servoactuator electronics In the TVC sub- 
system. The resulting engine deflection produces the desired attitude control 
torques In pitch, yaw, and roll. Roll control Is also maintained by the RCS 
roll-axis thrusters. During coast flight the error signals are processed In 
the DCU to generate RCS thruster commands with which to maintain vehicle atti- 
tude or to maneuver the vehicle. The coast-phase attitude commands are digi- 
tal on/off commands sent from the DCU to the sequence control unit (SCU). 
Sequence Is controlled by torques provided by 12 monopropellant N 2 H 4 
thrusters. The thrusters are fired In short bursts to hold the vehicle In a 
rate-displacement limit cycle. The SCU relays provide the necessary attitude 
control switching. 


Data Management Subsystem 

The data management subsystem (through the DCU) performs the computation, 
data processing, and signal conditioning associated with guidance, navigation, 
and control; safe/arming and firing of the pyro devices; controlled venting 
and pressurization (CCVAPS); propellant utilization (PU); telemetry formatting 
and data flow between remote sources and the pulse code modulation (PCM) 
transmitting equipment; and Issuance of vehicle events and commands to the SCU 
for proper switch on/off times. It also Issues discretes, Including space- 
craft discretes of any desired pulse width duration. These discretes can be 
made two-fault tolerant by selection. 

The DCU Is a modular, general-purpose digital computer manufactured by 
Teledyne. It is a 16 384-word, 24- bl t random-access core machine. The memory 
Is divided Into two distinct types. One type consists of 12K words of non- 
alterable memory (memory that cannot be altered on the vehicle but can be 
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changed with special test equipment at the factory). This Is the portion of 
memory In which the operational flight software resides. The other type of 
memory consists of 4K words of alterable random-access memory capable of con- 
taining flight and calibration constants that can be changed during the launch 
operations. 

The DCU's high speed Is achieved through functional paralllsm In the cen- 
tral processing unit that allows Independent functional units within the DCU 
to operate on a common register file. Up to five Instructions at different 
stages of execution can be handled simultaneously. For example, the DCU Is 
physically and functionally divided Into four sections: the logic section, 

the core memory module, the analog converter modules, and the power supply. 
From external sources the logic section receives velocity, ground support 
equipment data link, and timing data in the form of discretes, serial data, 
Incremental data, and real clock information. The logic section also provides 
control data and PCM data to external systems in the form of discretes and 
whole-word data. The core memory module senses, decodes, and stores infor- 
mation provided by the logic module. The analog converter module receives 
analog data from external units and converts digital data into ac and dc 
analog data output signals. The input/output (I/O) section handles the signal 
conversion necessary between the DCU and other system interfaces. 

The DCU uses the operational flight software to perform in-flight calcu- 
lations and to initiate vehicle thrust and attitude functions necessary to 
guide the Centaur payload through a predetermined flightpath to final orbit. 
This stored program. Including data known as the onboard data load. Is loaded 
into the DCU's nonalterable memory at the factory, verified through various 
flight acceleration system tests, and checked out at the factory and during 
software-acceptance runs. 


Thrust Vector Control Subsystem 

The thrust vector control (TVC) subsystem is the Interface between the 
Centaur guidance and navigation subsystem and the Centaur main-engine glmbaled 
platforms for powered-flight attitude control. 

Centaur main-engine TVC is based on analog vehicle attitude errors 
received by the DCU from the IMG. These errors are generated by the digital 
autopilot software In the DCU, which accepts the IMG attitude errors and dif- 
ferentiates them to obtain vehicle rates and the desired engine actuator com- 
mands. The analog engine commands are sent from the DCU to the servolnverter 
unit (SIU), where they are power amplified. These commands send control sig- 
nals to servovalves of the hydraulic actuator assemblies, which control the 
flow of hydraulic fluid to the actuator. Feedback transducers close the 
servoloop (back to the DCU) and furnish position Instrumentation. 

The TVC hydraulic system Is composed of two identical and completely 
Independent servoactuator assemblies (one mounted on each main engine). These 
assemblies provide the force and velocity required to glmbal the main engine 
during Centaur powered flight In accordance with flight control commands. 

After Centaur separation the hydraulic recirculation motors are turned on to 
supply the hydraulic pressure to preposition the main engines before engine 
start. After main-engine cutoff (MECO) and after payload separation the 
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hydraulic recirculation pumps (low pressure) are used to glmbal the engines so 
that thrust from residual propellants flowing through the engines can aid In 
the retromaneuver. 


Telemetry and Instrumentation Subsystem 

The PCM telemetry subsystem Is used to gather vehicle performance Infor- 
mation and transmit these data to the ground monitoring stations. The major 
telemetry components are the PCM encoder (In the DCU), an S-band phase- 
modulated transmitter (2200 to 2300 MHz), a ring coupler, two antennas. Inter- 
connecting harnesses, and transmission lines. 

The central control unit, part of the DCU, gathers digital signals from 
the DCU and the remote multiplexer unit (RMU). These signals are combined 
serially to form the PCM digital pulse train, which modulates the S-band 
transmitter and is hard wired (land line) In parallel to the PCM ground 
station. The central control unit commands the RMU to sample the measurement 
signals at a predetermined sequence and rate. It determines the format 
(sequence of measurement addresses) by reading and Interpreting a segment of 
the DCU memory. Measurements are put on the PCM bit stream by the central 
control unit In the order of the format addresses. The PCM bit stream goes 
directly to the transmitter and before launch by land line to the PCM ground 
station. 

The ring coupler accepts the output of the S-band transmitter and divides 
the power equally to the two antennas. The ring coupler Is located on the 
equipment module. Thus with the power being split and feeding both antennas, 
ground coverage Is excellent. 

The antennas accept the radiofrequency (RF) energy and radiate It In an 
omnidirectional pattern. Both antennas are mounted on the vehicle's stub 
adapter. 

The Instrumentation and telemetry function can be configured to match the 
vehicle or mission. As many as 1536 measurements can be Individually 
addressed. DCU Internal data can also be addressed. Each PCM data word has 
eight bits. Analog signals are converted to digital by eight-bit converters 
that cover the signal range being serviced (low, medium, or high). The signal 
conditioners rescale signals not lying reasonably within one of these ranges 
to match a range. Events are grouped In clusters of eight, all of which are 
reported when that group Is addressed. 

Formatting, or the sequencing of PCM addresses. Is done by programming a 
dedicated area of DCU memory. Up to four formats can be stored, and the one 
In use at any time Is selected by the DCU program being executed. The maximum 
selectable bit rate Is 267K bits per second. This non-return-to-zero PCM 
signal has 240 eight-bit words per frame containing guidance, navigation, and 
control parameters handled by the DCU. The parameters are sampled at various 
rates. Additionally the PCM eight-bit word frames (24 frames to a data cycle) 
contain the analog outputs and bilevel status sampled from different equipment 
and transducers (located throughout the vehicle) at various rates. 

The PCM telemetry characterizes the Instrumentation function on Centaur. 
Measurements that are not digital are converted to digital representations 
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before transmission. Measurements of several types are accommodated by signal 
conditioners that convert measurements to voltages usable by the PCM for- 
matting hardware In the DCU. The Instrumentation and telemetry function col- 
lects, digitizes, and sends to the ground measurements made on the airborne 
systems In order to establish the flight readiness of the onboard Centaur 
systems during prelaunch operations and for postflight analysis. 

Measurements, made directly or by transducers, are collected by the RMU . 
Analog signals are scaled by the signal conditioners before reaching the 
RMU's, where they are digitized. Event signals go directly to the RMU's. The 
RMU's identify signals by addresses and when addressed by the DCU (or CCU) 
send these measurements to the DCU (or CCU). 

The RMU Is tailored to Its requirement by the Inclusion or omission of 
circuit boards that service the various types of signals. The RMU contains 
analog-to-dlgltal (A/D) converters, registers, logic, and power supplies. 
Additional measurements can be accommodated by adding circuit boards of RMU's 
and extra signal conditioners and by Including these measurements In the PCM 
format. 

The PCM signal conditioners transform a variety of signals Into standard 
signals required by the RMU and supply electric power or excitation to the 
transducers, as required. The signal conditioners have a complement of con- 
ditioning components capable of satisfying local transducer excitation and 
measurement transformation (l.e., attenuation, discrimination, and presampling 
filtering). Transducer excitation is provided so that an overload In one 
transducer will not adversely affect the excitation of the other. The signal 
conditioners, like the RMU, are tailored to their specific tasks. They con- 
tain the circuitry to convert measurements to signal voltages compatible with 
the analog ranges available In the DCU. 

Transducers (such as crystals and diaphragms) sense physical phenomena 
changes (such as pressure, temperature, and strain) In Centaur's behavior by 
converting this energy Into an electrical signal. The transducers activate 
electrical circuits to which they are coupled, causing a change In the cir- 
cuit's output signal. The change in electrical signal Is on a one-to-one 
basis for the particular parameter being monitored. Transducers are selected 
from a standard list to convert physical measurements Into corresponding 
voltages. 

During checkout and launch the PCM elements of the Instrumentation and 
telemetry systems are checked out by the computer-controlled launch set (CCLS) 
through the PCM data station (using the land-line link to the DCU) and the PCM 
downlink. Radiofrequency telemetry signal radiation to local ground stations 
Is required to verify flight readiness of the telemetry system and vehicle. 


Electric Power Subsystem 

The Centaur vehicle electric power system consists primarily of a 28-V dc 
main vehicle battery and Its associated power distribution system. Three 
separate buses distribute power from the main vehicle battery through the 
electrical harnesses to the various vehicle loads. The SCU Is the focal point 
of electrical busing and distribution. This unit controls most of the Centaur 
switched loads by providing relay contact closure upon commands by the DCU. 
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Switching requirements are fulfilled by the power changeover and arm/safe 
switches of the SCU. The power changeover switch distributes uninterrupted dc 
power from the ground power supply to the vehicle. The arm/safe switch 
Isolates vehicle functions that require safety (i.e., pyrotechnic and engine 
start) . 

The main vehicle battery, a manually activated silver oxide/zinc battery, 
Is located on the equipment module. It supplies power to the three separate 
buses In order to Isolate equipment that tends to generate electromagnetic 
interference from equipment that may be sensitive to electromagnetic inter- 
ference. For example, loads on bus 1 and bus 2 are primarily loads that tend 
to be sensitive to electromagnetic Interference. Bus 3 supplies power to 
switching loads such as solenoids, relays, and motors. This bus carries loads 
that tend to generate electromagnetic Interference. Because the positive 
buses are common only at the battery and the ground power supply (the vehicle 
ground point Is internal to the SCU), the need for a filter is minimized. 

The single-phase Inverter In the S1U provides the 400 Hz, 26 V ac needed 
to supply power to the Instrumentation, the rate gyro unit, and the propel- 
lant utilization servopositloners . The Inverter also supplies 115 V ac for 
use by the PU servoposltioners . 

Before flight the vehicle power is supplied by a ground source. The 
power changeover switch (located In the SCU) Is activated before launch and 
connects the Internal power source (main vehicle battery) to the power dis- 
tribution system. The power changeover switch features a make-before-break 
contact arrangement to ensure uninterrupted power to the loads during power 
changeover. The main vehicle battery then continues to supply power through- 
out the remainder of the mission. 

Centaur's electric power system employs a single-point ground. For 
Individual system usage the current is monitored at the single-point ground 
bus in the SCU. 


Vehicle Sequencing Control Subsystem 

The SCU contains the logic to decode DCU sequencing commands (22-bit par- 
allel word command) and 96 magnetic latching relays. It Is also the Interface 
between the DCU output registers and the vehicle systems requiring switch or 
timed commands. The SCU transmits all sequencing commands to the vehicle sys- 
tems and, If so desired, 16 discrete commands to the spacecraft. 

The SCU together with the DCU performs the necessary timed sequencing 
functions after Centaur lift-off. The SCU receives data from the DCU as a 
22-bit parallel output word and decodes the word to operate output switches in 
groups of 16 each time It receives an execute command. Six sequential Input- 
word strobe commands are required to change the state of all 96 output 
switches. This DCU/SCU Interface consists of a 22-bit register and strobe. 

The SCU requires both the zero-through-21 -bit command and a strobe to Inter- 
pret the switch register command. Each Input line voltage Is compared with a 
reference to verify Its proper magnitude. The output relays are arranged In a 
6x16 matrix with the set or reset coll at the cross points of the row and 
column lines. They constitute the basic SCU memory capability. All lines 
exiting the package, except for direct ac and dc relay output lines, are 
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Isolated so that an external short to ground or an open circuit will not over- 
stress any package component. 

The mix of output (ac and dc) contact closure is designed to run the 
Centaur vehicle and to furnish sufficient spares to accommodate reasonable 
mission-peculiar changes. In addition, the SCU performs al rborne-to-ground 
power changeover and arm/safe functions on critical outputs through multipole 
motor-driven switches. The arm/safe switches permit selection of either the 
safe mode for ground test and operation or the arm mode for ground test and 
flight for Centaur safety functions. The switches are remotely operated by 
ground control. The arm/safe switches are single-pole, double-throw break- 
before-make contacts, plus a set of motor control and monitor contacts. Diode 
suppression Is employed In the arm/safe and relay outputs. A separate system 
Is required to separate the spacecraft from the Centaur at a predetermined 
time. Signals for the start of spacecraft separation are supplied by the SCU 
through a pyrotechnic control unit to the spacecraft In-flight separation 
plane. Power to begin spacecraft separation Is supplied by the Centaur main 
battery. This system Is part of the mission-peculiar (mission dependent) 
requirements. 

The SCU is checked out and calibrated at the factory with special test 
equipment at the unit level. Functional testing Is performed by the CCLS at 
both the factory and the Eastern Test Range (ETR). 


C-Band Tracking Subsystem 

The C-band tracking subsystem determines the Centaur Dl-A real-time posi- 
tion and velocity. The system Is compatible with the ETR ground system and 
provides data to support the range safety requirements (l.e., Atlas/Centaur 
vehicle position and velocity). These data are used to describe vehicle per- 
f nrmanr p and tn provide real-time predictions to support range safety flight 
requirements. When coded double RF pulses (interrogations) from the partici- 
pating ground radar are received by the C-band transponder system, an RF pulse 
(reply) on a different frequency Is transmitted after a short, fixed delay 
time. The Interrogation signal Is received at the vehicle by one or both of 
two antennas mounted on opposite sides of the Centaur tank. The transponder 
output signal, after division by the power divider, Is radiated from the same 
antennas to the radar ground station (or stations). The time delay between 
transmission of the interrogating radar and receipt of the C-band transponder 
reply Is a measure of the vehicle range. All radar ground stations within 
range of the vehicle can Interrogate the vehicle transponder continuously by 
using a synchronized, rapid, sequential time-sharing technique. The round- 
trip transit time of the pulsed signal (compensated for beacon delay) Is 
measured and used by the radar computer to determine the vehicle range. The 
elevation and azimuth angles of the returning signal are transferred to the 
radar computers and recorders directly from elevation and azimuth shaft 
encoders to determine the vehicle location. 

The transponder operates In a frequency band of 5400 to 5900 MHz. The 
power divider is a tee device that connects the signals from the two antennas 
and provides the Interconnections to the transponder. Each antenna can 
receive the Interrogating signals from ground radar and radiate the replying 
signals from the transponder. The antennas provide an omnidirectional RF 
radiation pattern about the vehicle In flight. 
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System-level tests are performed after the Individual dual components are 
Installed on the vehicle. Testing Is performed both at the General Dynamics 
Space Systems Division factory In San Diego and at the ETR to demonstrate 
proper operation. Open-loop testing is performed at the ETR with ground radar 
before launch to ascertain compatibility and to ensure that the systems will 
perform their Intended functions. 


Range Safety Command Subsystem 

The range safety command (RSC) subsystem terminates the flight of the 
Centaur Dl-A on command from the ground (l.e., If continued flight would 
endanger life, property, or the Interests of the Government. The RSC system 
Is compatible with the ETR ground system and Is completely redundant except In 
the antenna/hybrid junction combination and the explosive tank destructor. 

The RSC system comprises the RSC batteries, two antennas, a power control 
unit, two command destruct receivers, a hybrid junction, an arm/safe Initia- 
tor, an explosive destruct charge, and a mild detonating fuse assembly. 

The RSC system receives and decodes range safety commands from the ETR 
command ground transmitters. The command-code tone modulation frequency, 
carrier frequency, and operation sequences are established by the ETR. 
Command-code tones are used In various combinations to establish a MECO, a 
destruct, or an RF disable as follows: 

(1) MECO: This command cuts off the Centaur Dl-A main engines In 

response to an RF command (MECO) thus Imposing a condition of zero thrust or 
preventing the starting of the Centaur main engines. 

(2) Destruct: Provided that the MECO command has been received, this 

command activates the arm/safe Initiator and explodes the explosive destruct 
charge through the mild detonating fuse assembly. The charge is designed to 
rupture the liquid hydrogen and liquid oxygen tank structures, dispersing the 
propellant and destroying the vehicle. 

(3) RF disable: This command disables the RSC system In flight by 

removing operating power from the two command receivers. 

As the Centaur vehicle follows Its prescribed fllghtpath, the RSC RF 
carrier Is transmitted from successive ETR ground transmitting stations. The 
carrier Is picked up by one or both of the two antennas. The signal Is con- 
ducted from the antennas to the Input parts of the hybrid junction. The two 
output parts of the hybrid junction are connected to the two command receivers. 

Where the carrier Is modulated with command tones (destruct), the tones 
are demodulated within the receivers and converted to 28-V dc commands as 
described previously. The three commands are routed from the receivers Into 
the power control unit, where they are conveyed by relay switching circuits to 
their respective destinations: (1) the MECO command to the engine prestart 

circuits (via the SCU), (2) the destruct command to the destructor, and (3) 
the RF disable command to the power changeover switches (within the RSC power 
control unit) to remove power from the RSC system. The power Is supplied by 
two Identical batteries. One battery supplies each redundant half of the 
system. Circuit isolation makes each battery and its associated equipment 
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completely independent of any single failure of the other battery and its 
associated circuitry. 

System-level tests are performed after the individual components are 
installed on the vehicle to ascertain that the system will operate properly 
and perform its Intended function. The tests are performed both at General 
Dynamics San Diego and at the ETR. An Inert destructor is used in these tests 
before the final countdown at ETR. On launch minus 1 day the live destructor 
is Installed, and from that point on the system is tested with the live unit. 


PROPELLANT/PRESSURIZATION MANAGEMENT AND CONTROL 
Propellant Utilization System 

To realize optimum performance in a liquid-fueled bipropellant space 
vehicle, it is necessary to control both propellants so as to deplete them 
simultaneously. Such a simultaneous depletion both minimizes vehicle burnout 
weight (by not allowing any unusable amounts of one propellant or the other to 
remain in the tanks) and maximizes the mission total Impulse (by using all 
available propellant mass in engine reaction). 

Two major factors influence simultaneous propellant depletion. The first 
is accurate calibration of engine mixture ratios, flow rates, and total thrust 
under flight conditions. The second is the inability to predict the relative 
propellant masses to be loaded at lift-off. Even if such a prediction were 
possible, uncertainties in determining what has actually been loaded onboard 
provide the second large error source. As an example, for the Centaur two- 
burn vehicle, these errors would result in a maximum error in mass ratio 3 a 
of approximately 350 lb at burnout, resulting in a loss of 350 lb of payload 
capability from a mission requiring propellant depletion. Clearly then, one 
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system for propellant management. 

For Centaur the first function of such a system for proper propellant 
utilization (PU) is to measure accurately the ratio of propellants in the 
vehicle tanks during the entire powered flight portion of the mission. 

Centaur has a contoured concentric-cylinder capacitance probe Installed in 
each tank. The space provided between the inner and outer plates is open to 
allow liquid hydrogen or liquid oxygen to fill the probe. When the space is 
empty of liquid, the capacitors display a higher dielectric constant since 
they are of the air dielectric types. Propellant displaces the gas and 
Increases the element capacitance. Probe shaping (to compensate for tank area 
variance) makes the Increase in capacitance directly proportional to the 
Increase in propellant mass. Therefore exciting the probe from an ac source 
produces an output current proportional to the empty (dry) capacitance plus 
the increase in capacitance due to propellant mass (i.e., the change in 
capacitance per unit probe length is proportional to the tank area (shaping), 
and hence the Integrated change is proportional to the propellant mass). 

The second basic function of the PU system is to control the flow of pro- 
pellant through the engines to adapt the ratio of hydrogen and oxygen to the 
amounts remaining in the tanks. 
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In operation the PU probes are excited from an ac source provided by the 
SIU. Currents from the PU probes are rectified and summed at the Input to an 
operational amplifier to produce an error signal proportional to the error In 
the In-tank propellant mixture ratio. The probe excitation Is designed to 
provide an equal change In current for the liquid oxygen and liquid hydrogen 
probes from full to empty conditions. 

If the ratio Is not correct and an error signal is produced. It Is detec- 
ted by the DCU through one of Its A/D converters. The DCU In turn generates 
opening and closing commands to the PU servoposltloners by commanding SCU 
switches through the normal DCU/SCU Interface. The servoposltloners are 
Installed on the oxidizer flow-control valves for each engine and are motor 
driven. A change In the liquid oxygen flow-control valve modifies the engine 
Inlet conditions such that the engine controller adjusts both liquid oxygen 
and liquid hydrogen flows to the new desired mixture ratio. The PU servo- 
positioner angles are measured and sent back to the DCU to close the servo- 
loop. In practice, the error signal at the desired mixture ratio Is not 
always zero volts; the DCU establishes the Initial zero value and uses that 
for the system baseline. Mission- related biases (such as error bias and coast 
bias) are also loaded In the DCU software (PU flight constants) and are added 
or subtracted as required by the mission status. Additionally Included within 
the DCU software are failure tests for excessive amplitude error signal as 
well as tests for failed servoposltioner feedback signal. The constants also 
define other system requirements, such as the time to activate the system and 
the time to deactivate the system, to allow final guidance computation without 
PU valve (thrust) motion. 


Propellant Pressuri zatlon and Vent Control 

General . - The propellant feed and main-engine system provides the 
Centaur vehicle with thrust by burning liquid hydrogen and liquid oxygen pro- 
pellants. The net positive suction pressure (NPSP) required by the engine 
turbopumps Is produced by pressurizing the propellant tanks. 

The propellants are delivered to the main-engine turbopumps through feed 
ducts from the vehicle tanks. The feed systems consist of Individual duct 
assemblies and pneumatically actuated prevalves. The prevalves, located at 
the tank outlets, together with the engine Inlet shutoff valves constitute the 
two Independent in-series propellant shutoff devices. A multilayered radia- 
tion blanket, covers the entire feed delivery system to control thermal 
radiation. 

The propellant feed and main-engine system Interfaces with the pneumatic 
system at the propellant prevalve panel assembly. This assembly supplies 
regulated gaseous helium to open the liquid hydrogen and liquid oxygen pre- 
valves and to control engine-valve pressure for prechill, prestart, and engine 
operation. The propellant feed and main-engine system pressurizes the liquid 
hydrogen tank during Centaur flight by bleeding off gaseous hydrogen from each 
engine feed Injector manifold (autogenous pressurization). Flow Is directed 
through flexible lines to accommodate engine glmballng. 

The flight operations control Interface for the main engine Is provided 
by the DCU, the SCU, the SIU, and the DCU guidance software. The engine fuel 
prestart, oxidizer prestart, and start solenoids and Ignition systems are 
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operated by the SCU switches through DCU commands. Individual SCU switches 
are required for each function; however, a single SCU switch is provided to 
control the same function for each engine so that they can be switched on and 
off simultaneously. 

Pressurization, purging, and Intermediate bulkhead vacuum maintenance are 
among the functions of the pneumatic system. The vent system, In conjunction 
with the pneumatic system, maintains pressure in the main propellant tank. 
Purging with gaseous helium prevents moisture from entering cryogenic systems 
and causing Icing. Many vehicle systems and components are purged both before 
and during flight. 

Pressurization comes from two sources. With no propellant In the tank 
pressure Is furnished by a gaseous helium system. After propellants are 
loaded, propellant bolloff pressurizes the tank. During flight the airborne 
helium system provides supplementary pressure when necessary. The same system 
also furnishes pressure for the N 2 H 4 and engine control systems. 

The tank pressurization system controls the flow of helium from the 
helium supply system Into the main propellant tanks. During engine burn It 
also controls the flow of gaseous helium from the engine into the hydrogen 
tank. The system consists of valve modules, orifices, filters, check valves, 
and control pressure transducers. The liquid oxygen tank is pressurized with 
helium during engine burn, and the liquid hydrogen tank is pressurized by 
autogenous pressurization. Check valves are used In the autogenous pressuri- 
zation system to prevent hydrogen from backflowing In the engine chamber (or 
chambers) . 

Computer-controlled venting and pressurization system . - The computer- 
controlled venting and pressurization system (CCVAPS) was originally developed 
for Titan/Centaur and was later Introduced on the Atlas/Centaur vehicle. 
Ti+an/rpn+anrc i tn 7 and At 1 a <; /Centaur s 36 to the Dresent used the same basic 
software design; however, modifications were made to accommodate mission- 
peculiar requirements and other engineering changes. 

Centaur vehicles used with Atlas boosters were redesigned beginning with 
vehicle AC-62 by removing the hydrogen and oxygen boost pumps. Pressurization 
of the liquid hydrogen and liquid oxygen tanks must therefore satisfy the 
main-engine requirements rather than the boost pump requirements. Pres- 
surization of the hydrogen and oxygen tanks was changed to accommodate this 
pressure-fed system as follows: 

(1) By Increasing the pressure In both tanks to satisfy engine start and 
operating requirements 

(2) By pressurizing the oxygen tank with helium during engine burn. 
Vehicles with an oxygen boost pump required no pressurization during engine 
burn . 


(3) By pressurizing the hydrogen tank with gaseous hydrogen supplied by 
the main engines during engine burn. Vehicles with a hydrogen boost pump 
required no pressurization during engine burn. 

The major changes, as of this date, are as follows: 
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(1) Propellant tank ullage pressures at Atlas/Centaur separation were 
lowered to pre-AC-62 levels to reduce the magnitude of pressure-induced 
stresses In the propellant tanks during separation. 

(2) Propellant tank ullage pressures were lowered for main-engine start 
(MES) and engine burn on the basis of the following criteria: 

(a) Tanks are not pressurized to levels sufficient to provide 
specification-required NPSP under single-failure conditions but pro- 
vide the minimum required NPSP under worst-case nonfallure 
conditions. 

(b) On the basis of testing for shuttle/Centaur the main-engine 
specification has been revised by expanding the regions In which the 
engine pump operates at Inlet conditions. The new minimum pump 
Inlet requirements allow tank pressures to be reduced. This reduc- 
tion causes a corresponding reduction In helium usage for the 
mission. 

(3) Pressure In both tanks was stepped to an Intermediate level for 
Atlas/Centaur separation. Postseparation pressurization for MES1 will begin 
0.2 sec after the SCU command for separation, to allow sufficient time for the 
shock induced by firing the separation charge to damp out. 

(4) Post-MEC02 liquid hydrogen tank venting, including settling motor 
operation, was Increased from 10 to 30 sec to guard against a Increase in 
rapid liquid hydrogen tank pressure due to unsettled liquid hydrogen at MEC02. 

System description: The major components and subsystems that make up the 

tank pressurization control system are three CCVAPS pressure transducers for 
each tank, a hydrogen-tank primary vent valve, a hydrogen-tank secondary vent 
valve, an oxygen-tank vent valve, a helium pressurization system, a hydrogen 
pressurization system, the DCU, the SCU, and the RCS settling motors. 

The three CCVAPS transducers are used to monitor the pressure In each 
tank. These analog data are supplied to the DCU, where they are converted to 
digital Information for use by the DCU. Transducers 2 and 3 share a common 
DCU A/D channel. They are switched out and In, respectively, by the SCU. Two 
parallel SCU switches control each transducer (2 and 3) to provide single- 
failure tolerance for switching transducers. 

When unlocked by CCVAPS the hydrogen-tank vent valves and the oxygen-tank 
vent valve open and relieve tank pressure when the valve cracking pressure is 
exceeded. Venting ceases when the tank pressure drops below the valve reseat 
pressure or when the valve Is locked by CCVAPS. The cracking and reset pres- 
sures are higher for the hydrogen-tank secondary vent valve than for the pri- 
mary valve. Each vent valve can be locked to prevent venting by energizing 
the locking solenoid, which Is controlled through an SCU switch. 

The helium pressurization system allows helium gas to enter the hydrogen 
or oxygen tank according to which valves are opened. The system for each tank 
contains a primary and a backup pressurization valve. A pressurization con- 
trol valve Is located upstream of both primary pressurization valves and Is 
common to both tanks. It must be open when either the hydrogen or oxygen tank 
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1$ pressurized with the primary valves and Is part of the primary pressuri- 
zation system. Each valve Is controlled through a separate SCU switch. 

The hydrogen pressurization system, which has three branches. Is active 
only when the main engines are running. Gaseous hydrogen Is generated by the 
engines and flows continuously to the hydrogen tank through branch 1. 

Branches 2 and 3 each contain two valves In series. Branch 2 contains the 
primary set of valves and branch 3 contains the backup. Each valve Is con- 
trolled through an SCU switch. 

The RCS settling motors each contain two solenoid valves In series. A 
separate SCU switch Is connected to each solenoid; thus two SCU switches must 
be set to operate one settling motor. Thrust from these motors Is directed 
forward to achieve propellant settling. When only two motors (four total) are 
operated together, one Is from quadrant II and the other from quadrant IV to 
produce a balanced moment about the vehicle center of gravity. 

CCVAPS software: The CCVAPS software monitors hydrogen and oxygen tank 

pressures separately but concurrently throughout the Centaur mission. This 
software uses only data from transducer 1, which are continually checked for 
accuracy by comparison with transducer 2 data. When either transducer 1 or 2 
falls, by exceeding the allowable bandwidth, CCVAPS software sends commands to 
switch out transducer 2 and switch In transducer 3. CCVAPS software then con- 
ducts a reasonableness test on the data to determine which of the three trans- 
ducers to use. 

The reasonableness test consists of storing data from the last valid 
pressure reading of transducers 1 and 2. The most recent data from trans- 
ducer 3 are then compared with the average pressure of transducers 1 and 2 
(plus or minus the maximum rise or decay rate times the maximum elapsed time 
for the last valid pressure reading). If the transducer reading Is within 
tms pressure Dana, n is cunsiutrreu vaViu uaLa aim lianauuwci 3 u^u to 
monitor tank pressures. If transducer 3 data are outside the band, the soft- 
ware will not use this transducer but will Instead check transducer 1 data for 
reasonableness. If neither transducer 3 nor 1 has valid data, CCVAPS commands 
transducer 3 to switch out and switches In transducer 2. The reasonableness 
test, If required, Is conducted only once during the mission. The transducer 
found to be valid by the test Is used for the remainder of the mission. 

Venting control Is active during the boost phase and all coast phases. 
During the boost phase tank pressure Is controlled at the cracking and reseat 
pressures of the vent valves. For the hydrogen tank the Initial boost-phase 
pressure Is controlled by the secondary vent valve. The primary valve Is 
locked. CCVAPS controls the primary valve In a backup mode to vent the hydro- 
gen tank In case the secondary vent valve falls to crack open. During the 
latter part of the boost phase the hydrogen-tank primary vent valve Is also 
unlocked to control the tank pressure at a lower level. The oxygen-tank vent 
valve Is continuously unlocked during the boost phase. As a backup mode for 
all vent valves, CCVAPS monitors the vent valves for failure to reseat and 
then commands the failed valve to lock In an attempt to close It. 

During all coast phases, except the post-MECO liquid hydrogen vents, the 
vent valves are maintained locked. When tank pressure rises, usually because 
of heating, to a predetermined value, CCVAPS Initiates the vent sequence. 

This sequence comprises a series of timed settling motor operations followed 
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by actual tank venting. Propellant settling may be required prior to venting 
to ensure that liquid hydrogen and liquid oxygen are absent from the vent 
valves when venting occurs. Initial settling is performed with two settling 
motors on. Venting is Inhibited during this initial settling period. When 
the initial settling period ends, all four settling motors may be turned on to 
coincide with actual venting. Venting is begun (i.e., the vent valve is 
unlocked) when CCVAPS determines that the tank pressure exceeds a pre- 
determined value. 

When tank pressure drops to a lower predetermined value, CCVAPS commands 
the vent valve to lock and venting ceases. The vent valve will cycle between 
the vent (unlocked) position and the no-vent (locked) position according to 
fluctuations In tank pressure as monitored by CCVAPS software until the end of 
the vent period. For zero-g coasts settling motor operation is controlled by 
CCVAPS; for settled coasts at least two settling motors are already on, and 
CCVAPS does not control the settling motors, except to turn on all four for 
venting as required. 

Venting is also provided for structural (safety) protection of the 
propellant tanks and intermediate bulkhead during the venting mode. When tank 
pressures are near the structural limits of the tank or the Intermediate bulk- 
head, CCVAPS begins venting Independent of the normal vent mode and settling 
motor operation. 

CCVAPS controls the propellant tank pressures during periods other than 
venting control. Pressurization is required during those periods to provide 
NPSP and total pressure for the main-engine pumps for engine start and steady- 
state operation. Before the first MES both tanks are pressurized to pre- 
determined intermediate levels for Atlas/Centaur separation. Pressurization 
of both tanks Is begun by CCVAPS before each engine start to allow time for 
the pressure to rise to predetermined levels. The tanks are also pressurized 
before Atlas/Centaur separation to bring them to the proper pressures for 
separation. 

The helium pressurization system is used to pressurize both tanks until 
approximately 4 sec after MES. The pressurization control valve Is opened by 
CCVAPS commands when pressurization of the tank Is first required and remains 
open until MES + 4 sec. When CCVAPS determines that the tank pressure Is 
below a predetermined level, the primary pressurization valve Is opened. When 
the proper pressure exists in the tank (or tanks), the valve is closed. 

CCVAPS continuously monitors for failure of the primary valve to open or 
close, except during most of the engine burn, when no fal 1-to-close pressures 
are monitored. When either tank pressure Is excessively low or excessively 
high, CCVAPS interprets this as a failure of the primary pressurization system 
and switches to the backup system for both tanks. Failure of either the 
hydrogen or oxygen primary system causes both tanks to switch to the backup 
system because of the common pressurization control valve. CCVAPS maintains 
proper tank pressures by controlling the backup valves for the remainder of 
the mission in the same manner that it controlled the primary valve. 

During engine burn the helium system Is used to pressurize the oxygen 
tank, and gaseous hydrogen bled from the main engines Is used to pressurize 
the hydrogen tank. CCVAPS monitors oxygen-tank pressure and begins or ends 
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pressurization when deficient or excessive pressures occur. The pressuriza- 
tion control valve and the primary pressurization valve are operated together 
for each pressurization cycle, providing single-failure tolerance for 
overpressurization and eliminating the need for fal 1-to-close logic during 
burn. Note that failure of the oxygen primary system during engine burn 
(backup In use) will not affect the gaseous hydrogen pressurization system, 
which Is operating during engine burn. 

The safety of the Intermediate bulkhead Is preserved by controlling the 
hydrogen-tank primary vent valve and the oxygen-tank vent valve during the 
venting modes and by controlling the active pressurization system during the 
pressurization modes. CCVAPS monitors the differential pressure AP across 
the Intermediate bulkhead with respect to predetermined high and low AP 
safety values and vents or terminates pressurization In the oxygen or hydrogen 
tanks to maintain the Intermediate bulkhead AP In the safe range. For 
Intermediate bulkhead protection during venting the safety logic will lock the 
vent valve on one tank when venting the other tank. This prevents the AP 
across the Intermediate bulkhead from worsening. 


DIGITAL COMPUTER UNIT SOFTWARE 

The Centaur Dl-A software was designed to satisfy specific objectives In 
the areas of cost, reliability, launch simplicity, response, and resiliency. 
The following procedures were followed: 

(1) To minimize cost, many of the mission- and vehicle-peculiar changes 
formerly requiring hardware are now Implemented via software. 

(2) To realize high reliability, the software was designed to simplify 
checkout and to ensure an error-free flight program. 

(3) lo acnieve launcn simplicity, i-iie buftwaie wai ucaiyucu lu allow . iu- 
sonable last-minute changes In applicable areas and test philosophies. 

(4) For quick response, or to reduce lead time, the software was con- 
structed In modular fashion. Thus one module can be checked and changed with- 
out disturbing the configuration of other modules. 

(5) To provide resiliency, the software was designed to remain Intact and 
functioning In the unforeseen event of failures In the external system hard- 
ware. Its task Is to achieve maximum flight success In spite of system 
failures . 


Modularity 

A modular software concept fulfills the requirement for a cost-effective 
and flexible system. The concept classifies software Into two categories: an 

executive system that remains unchanged through all missions, and a set of 
mission- or vehicle-peculiar task modules that can be selected from a library 
and adapted for the current mission. The test modules are flexible: they can 

be scheduled by the executive at different frequencies during flight, turned 
off or reactivated for different phases of flight, and Interrupted at any time 
during their operation. Since the modules do not communicate directly with 
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each other, but only through the executive, they are assured of consistent 
sets of data. The system Is also readily changeable. 

Assuming that memory and duty cycle are available, new modules can be 
added or mission-peculiar modules Interchanged. Change flexibility Is 
enhanced by subdividing the task modules Into subroutine blocks whenever pos- 
sible. Program changes are Inserted at the module (or subroutine) level and 
checked at the module and Integrated program levels (all task modules opera- 
ting together as a system). 

Both real-time and vehicle telemetry Interrupts will occur during a 
flight. By design an Interrupt will cause the program to suspend whatever It 
Is doing and force It to a preset address In order to execute the Interrupt 
subroutine. Upon completion of the Interrupt subroutine the program returns 
to the Interrupted address and resumes whatever It was doing. 

The Centaur software Is designed so that any combination of two or more 
modules can be In a simultaneous state of Interrupt; furthermore the Interrupt 
Is allowed at any location In the program. Thus the modular task programs are 
completely Independent of the Interrupts, and each one can be coded as If It 
were the only module In the computer. 


Decentralized, Parallel Design and Checkout 

Functional tasks are designed as separate software modules and are devel- 
oped and checked out In parallel. The checkout of the software Is subdivided 
Into the task level and the Integrated level. The software system structure 
Is designed to be general enough so that revised or new modules can be 
Incorporated after the first Integrated checkout with minimum effort. After a 
revised module Is completely checked out, it Is added to the modular library. 
The decentralized checkout cohcept minimizes the reaction time of the software 
to changes and promotes maximum reliability by providing detailed engineering 
visibility at the task and Integrated levels. 


Contingency Software 

In the event of certain external equipment failures (e.g., unscheduled 
thrust termination or failure to start a stage) the software can be used to 
select reasonable alternative strategies. 

The software senses nonstandard environments (such as a large-state drop 
In thrust level) and makes appropriate adjustments to the trajectory. The 
recovery techniques are designed so that the mission Is achieved within the 
performance capability of the launch vehicle. 


Flexible Ground/Computer Interface 

The DCU operates In conjunction with the ground computer-controlled 
launch set (CCLS) to perform many preflight vehicle and avionic systems 
tests. A modular DCU software concept Is again used; only now the modules are 
called tenants. The tenant programs are loaded from the CCLS to the DCU. The 
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DCU tenant program, operating in conjunction with Its corresponding ground 
CCLS tenant, services each vehicle or avionic system test. 

The tenant regions are sectors of temporary storage (In the DCU) allo- 
cated to the test programs. Flexibility Is such that any test program can be 
loaded Into any tenant region of the DCU. The tenants work In conjunction 
with the resident software control system, which starts and stops each tenant 
based on priority. Thus the tenants have the same Independence from the 
Interrupts as described previously. 

The communications link between the CCLS and the DCU also allows flexi- 
bility. A common format Is used to communicate data, programs, or special 
requests from the CCLS to the DCU. The downlink, or telemetry channel, Is 
formatted so that any word desired can be communicated from the DCU to the 
CCLS. 


Documentation 

The management and engineering Interface aid developed for Centaur D1 
software has been a flexible, decentralized documentation system. A document 
defines the design requirements for each software function, and after the 
module has been developed and checked out, a document provides a thorough 
functional description. 


Executive System 

The Centaur D1 flight program consists of subprograms In two basic cate- 
gories: system routines and functional tasks. System routines comprise the 

executive system control program execution, manage data flow between tasks, 
and service the computer I/O functions. The modular functional tasks, such as 
navigation and guidance, perform the computations that satisfy tne computer's 
responsibility with respect to Its external world. 

Clock pulses, which occur at 20-msec Intervals, generate a real-time 
Interrupt. The task currently In progress Is stopped and program control 
given to the executive. The executive first services the DCU I/O functions, 
then solves all 50-Hz tasks, and finally routes the program execution to the 
lower frequency task. 


Interrupts 

Two types of Interrupts will normally occur during flight: real time and 

telemetry. An Interrupt causes a transfer to the Interrupt processor. The 
interrupt processor saves the variables that were being calculated by the 
Interrupted program. A real-time Interrupt (also known and functions as the 
software clock) occurs at precisely a 50-Hz rate; a telemetry Interrupt occurs 
at approximately a 1000-Hz rate. 

"Power off" followed by "power on" are two other Interrupts that con- 
ceivably could occur during flight for some unplanned reasons. If these unex- 
pected Interrupts occur, the software Is designed to continue functioning In a 
reasonable manner. 
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If a telemetry Interrupt occurs, the program executes a subroutine that 
results In the emission of a telemetry word. For the real-time Interrupt the 
program executes the real-time Interrupt program, a system program that pro- 
vides I/O servicing and scheduling of task programs. 


Task Schedule/Task Table 

The task schedule scans the task table, which contains three entries for 
each task: 

(1) Normal task entry address 

(2) Required task solution period 

(3) Task start time 

The task schedule uses this Information to execute all software task programs 
at their required frequency and within the required time Interval. Inter- 
rupted tasks have the highest priority. 


Task Organization 

A "tree" structure Is used to organize the tasks. The tasks are grouped 
according to executive priority. Each task on the tree must appear as an 
entry In the task table. A 50-Hz drive Is used to control the execution of 
the 50-Hz tasks In order to save duty cycle. Thus only one call to the 50-Hz 
tasks appears on the task table. 


Adaption to Real Time 

If time is required by a software task to any resolution finer than 
20 msec, an Instruction count Is required or the countdown register may be 
implemented. With the countdown register discretes can be issued to a time 
resolution of 1.25 msec. 

Since the task programs are coded to be Invulnerable to random Interrupts 
and since they are minimally sensitive to changes In start time, the task pro- 
grams can be coded separately as If there were no time constraints. The term 
"Insensitive to time changes" means that If a task execution is skipped 
because of a temporary overload, the task will continue to function properly. 
The task schedules will compare actual start time with desired start time and 
recalculate a new start time If a temporary overload occurs. 


Input/Output Servicing 

The Input/output servicing subroutine is executed every time a real-time 
Interrupt occurs; It Interfaces DCU software with the I/O devices. Since the 
task program Interface with the I/O servicing software Is fixed, the func- 
tional task software reads the attitude signals from the resolver chain and 
the most recent 20-msec accumulation of velocity pulses. The output software 
stores the desired attitude vectors Into the resolver chain Input locations 
and Issues the discrete register bit pattern to external equipment. 
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Telemetry Formatting 


A PCM telemetry system Is used that results In the DCU words being Inter- 
mingled with all other vehicle telemetry data. The DCU data consume approxi- 
mately 10 percent of the PCM channel capacity, assuming that approximately 
1000 24- bl t DCU words are telemetered per second. 

The "fast" portion of the formatter establishes the frame marker and 
counter, approximately 16 out of the 18 data words. This fast portion Is 
actually performed as part of the real-time Interrupt service subroutine (I/O 
service). The fast formatter supplements the I/O service by assigning words 
to the remaining slots. To do this, It selects words from the lower frequency 
task buffers. The slow formatter moves the low-frequency task data from the 
current to the previous buffer, thus preparing these buffer tables for use by 
the fast formatter. Data from each task are moved at a different frequency; 
this means that the slow formatter need only be executed at the highest non- 
50-Hz task frequencies. 


Data Communication 

Intermodule data communication Is through the data management module, a 
subroutine with multiple entry points. Its basic function Is to load the 
task's Input or output buffer with the appropriate dynamic data. These data 
are defined In the I/O requirements of the task's documentation. 

The buffer fill operation Is protected by disarming the real-time Inter- 
rupt during this vulnerable phase. Since the dlsarm/arm sequences occur under 
the control of the executing task, a coherent set of the latest available I/O 
data Is always guaranteed. Furthermore these buffers remain static throughout 
the execution period of the task (I.e., until the executing task requests the 
data management module to refresh them again on the subsequent cycle). 


Task Table Modifications 

During a flight It Is sometimes necessary to enable or disable certain 
tasks, such as enabling the powered guidance task just after booster engine 
cutoff. Tasks can be enable or disabled by modifying the task start time. 

The frequency with which a task Is executed Is changed In flight by modifying 
that number on the task table. Also, a different portion of the task can be 
enabled by changing the task entry address. In general, task turnon, turnoff, 
or frequency change can be achieved by task table modification. Thus appro- 
priate use of the task table can facilitate this requirement and obviate the 
need for extra branches and flags. 


Functional Tasks 

The functional tasks performed by the DCU are coded In program modules. 
These modules are listed In the task table from which they are called by the 
executive for operation at the proper time to ensure correct module fre- 
quency. Some of the modules (e.g., navigation) operate throughout the flight; 
others (e.g., powered autopilot) are scheduled for only certain phases. The 
modules do not Interface with each other. Date flow Is controlled by the data 
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management portion of the executive. A brief description of some of the mod- 
ules follows: 


Navigation 

Functions 


Method 


To furnish position, velocity, and acceleration data to 
guidance 

Integrate In the true Initial coordinate system, having pre- 
viously converted for known platform drifts 


Guidance 

Functions To determine the steering coefficient data for optimizing the 
trajectory and to furnish the engine cutoff time to the 
sequencer 

Method Assume a near-optimum linear-target steering law in pitch and 

a calculus-of-variation steering law in yaw 


Steering 

Function To furnish the desired vehicle attitude to the platform 
resolver chain 


Method Compute the desired vehicle attitude from the guidance- 

supplied steering coefficients 


Altitude rate 

Function To furnish rate Information to the powered and coast-phase 
autopilots 

Method Compute the time derivative of the attitude error signal 


Powered-phase autopilot 

Functions To maintain control stability during main-engine firings and 
to control the vehicle axes to the desired attitude 

Method Compute engine gimbal output commands by using attitude errors 

and error rates as inputs to control laws 

Coast-phase autopilot 

Function To control the vehicle attitude during coast-phase maneuvers 

Method Command the N2H4 attitude control engines In the on/off 

mode 


Booster steering 

Function To steer the booster in pitch, yaw, and roll in an open-loop 

manner during ascent through the atmosphere 
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Method 

Postlnlectlon 

Function 

Method 

Sequencer 

Function 

Method 


Use polynomials In attitude to generate attitude as a function 
of altitude 


To provide steering coefficients to point the vehicle for 
separation and retromaneuver 

Output roll and pitch axes pointing vectors to the resolver 
chain 


To generate discretes for sequencing of all flight events 

Perform various tests to determine the time to Issue event 
discretes or to accept output from selected modules for 
module-dependent discretes 


Computer-controlled venting and pressurization system 

Function To maintain proper liquid oxygen and liquid hydrogen tank 

pressure 

Method Monitor tank pressures and command venting and pressurization 

valves to function via SCU switch commands 

P ropellant utilization 

Function To maintain a proper ratio of liquid hydrogen and liquid oxy- 

gen In the tanks to preclude a premature depletion of one or 


Method 

Queue 

Function 

Method 


Monitor the propellant ratio error signal and command the PU 
valves to a position that will null the error 


To resolve any potential conflict of simultaneous requests for 
switch action 

Assign priorities to switch requests and command switches 
according to the priorities 


Flight Program Validation 

The validation of the DCU software ensures an error-free program. Vali- 
dation checks that the software meets the design requirements, that the soft- 
ware and hardware Interfaces are correct, that an adequate duty-cycle margin 
exists, and that the software Is forgiving In the event of large hardware 
dispersions. 

The validation procedure consists of two testing phases: a design 

evaluation test and a design acceptance test. The design evaluation test Is 
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primarily a search for weaknesses In the design. The software Is severely 
stressed to determine the limits and to verify an adequate design margin. 

This Is accomplished by simulating and Inputting data representing failed or 
severely dispersed hardware systems Into the software. 

The second validation test, the design acceptance test. Is a formal pro- 
cedure that verifies that the program Is error free and qualified for 
release. The Input data are generally the limits of the acceptable flight 
environment ( 1 . e . , 3o dispersion or combinations of dispersions). This test 
verifies that the logic Is coded correctly and that the program meets the 
design requirements. 

The validation of the DCU software Is a multilevel function. It first 
takes place at the module level, where It results In a library of validated 
modules. Modules may then be combined Into subsystems for an Initial check of 
the module Interfaces. This subsystem level Is not part of the formal vali- 
dation procedure but serves as an Interim between the formal module and pro- 
gram validation. Validation of the Integrated flight program Is then 
performed. Finally a verification Is made using the targeted trajectories. 


Systems Management 

Centaur Dl-A software Is subject to controls from module Inception 
through flight. These controls ensure that the management of the software 
will be thorough and complete. The Software Review Board monitors all DCU and 
CCLS software from Inception on. This board Is made up of NASA Lewis, NASA 
Kennedy, General Dynamics, and Honeywell personnel. 

The change requirement system Is a formalized procedure for Initiating, 
approving, and recording changes to modules or programs. Change approval Is 
required from the Software Review Board chair. 

When a DCU model has been validated. It has a unique check number 
assigned to It. This number Is generated by the support software and will 
change with any change made to the module. 

Similarly when modules are assembled Into a program, a unique check num- 
ber Is calculated for that program configuration. This number Is sensitive 
not only to the modules In the program but also to the order In which they are 
assembled Into the program. 

The resources control process Is a continual review by NASA Lewis and 
General Dynamics management of new DCU software requirements that would use 
more storage or duty-cycle resources. The gains achieved by Implementing 
these requests are weighed against the ever-increasing load on the DCU. This 
review helps ensure that the DCU resources are used only for total D1 system 
Improvements . 


CONCLUDING REMARKS 

The Centaur vehicle provides the operational advantages of a high-energy, 
liquid-fueled upper stage, namely high specific Impulse, multiple burns, and a 
propellant load that can be varied to match mission requirements. Other 
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advantages are that It can be flown with or without a booster guidance system 
(as done on today's Atlas/Centaur) and features fault-tolerant designs and 
redundancy of critical functions. 

Centaur's design approach makes maximum use of space-qualified hardware. 
The piece-part levels for this program were likewise established to provide 
cost-effective, yet reliable; space-proven components. The system environment 
and operating requirements are thoroughly analyzed and are Integrated Into our 
reliability analysis. Reliability analyses Include a failure modes and 
effects analysis and numerical assessments. Selected redundancy, as discussed 
In the appropriate subsystem design sections, was Implemented to meet reli- 
ability requirements. 

Achievement of a high level of mission success depends on a full com- 
plement of requirements and controls provided by a comprehensive test and 
product assurance program. These programs were developed and implemented 
starting with the Titan/Centaur programs and now embrace all disciplines 
Involved In the life cycle of the Centaur system. Our mission success program 
has supported both the Atlas and the Atlas/Centaur programs. This common sys- 
tem approach ensures that all program elements affecting, or having the poten- 
tial to affect, readiness to launch or mission success are Identified, 
analyzed, and remedied through appropriate corrective action. It ensures 
sharing of lessons learned, program visibility, and a single focal point for 
program and problem communication. 

Centaur's mission success organization consists of three elements: cor- 

rective action, hardware review, and audit and vendor surveillance. The cor- 
rective action element of the organization provides the project with rapid 
Identification of problems; a strong, effective followup to closure, with high 
visibility of problems requiring management attention; and the ability to 
establish the status of total program hardware problems before an event. The 
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the division, the project, and major contractors and subcontractors. The 
hardware review element establishes the pedigree of related hardware and vehi- 
cle assemblies through mandatory Independent review of documentation associ- 
ated with building and testing. Anomalies are resolved for the hardware or 
article before It Is permitted to proceed Into Inventory use. The audit ele- 
ment evaluates the degree of compliance with NASA Lewis' program policies, 
procedures, and applicable technical requirements for processing, testing, and 
acceptance. Both the audit and vendor surveillance elements report deficien- 
cies to the Centaur management to ensure that effective corrective actions are 
Implemented. The corrective action and hardware review elements also report 
to the Atlas/Centaur manager. 

Within the framework of system maturity changes are continually evaluated 
to Improve Centaur's capability and performance. Two factors drive the con- 
tinual upgrading of Centaur's hardware and software: 

(1) New technology accounts for Improved electronic parts, components, 
and techniques. 

(2) New mission requirements demand Increased capability - from more com- 
putation capacity to greater accuracy. 


25 


In summary, It has been the purpose of this report to Identify and 
describe the unique aspects of the Centaur Dl-A system and to provide a quali- 
tative feeling for the different levels of effort Involved. 
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APPENDIX - GLOSSARY OF ACRONYMS AND ABBREVIATIONS 


AC 

Atlas/Centaur (usually followed 

by vehicle number) 

A/D 

analog to digital 


CCLS 

computer-controlled launch set 


CCVAPS 

computer-controlled venting and 

pressurization system 

DCU 

digital computer unit 


IMG 

inertial measurement group 


I/O 

input/output 


IRU 

inertial reference unit 


NPSP 

net positive suction pressure 


MECO 

main-engine cutoff 


MES 

main-engine start 


PCM 

pulse code modulation 


PU 

propellant utilization 


RCS 

reaction control system 


RF 

radiofrequency 


RMU 

remote multiplexer unit 


RSC 

range safety command 


SCU 

sequence control unit 


SIU 

servoinverter unit 
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